Cloud-Native Vulnerability Flow Validation Across Runtime and Infrastructure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application security testing solutions are inadequate for cloud-native applications, as they fail to address vulnerabilities that span multiple code and infrastructure layers, leading to poor security posture and inefficient use of developer resources.
Innovation Solution
A method that integrates with cloud-native applications during runtime to map and validate vulnerable flows by analyzing runtime functions, infrastructure configurations, and logical flows, using custom-crafted inputs to reduce false positives and provide accurate risk assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing application security testing solutions are used, then the testing process is simple, but the accuracy of vulnerability detection deteriorates because vulnerabilities span multiple code and infrastructure layers
Solution Approach 1:
The system segments the vulnerability detection process into multiple independent mapping phases: runtime function mapping, infrastructure configuration mapping, and logical flow mapping. Each phase handles a specific aspect of the cloud-native application, allowing complex multi-layer vulnerability detection to be broken down into manageable steps while maintaining overall accuracy.
Solution Approach 2:
The patent implements a nested mapping structure where runtime function mappings are contained within service mappings, which are contained within infrastructure component mappings. This nested architecture allows the system to handle the complexity of cloud-native applications by organizing detection data hierarchically, with each layer containing references to lower layers while maintaining independence.
2Reliability
If comprehensive vulnerability mapping is performed across all layers, then the completeness of security assessment improves, but the time required for analysis increases
Solution Approach 1:
The system performs preliminary mapping of runtime functions, infrastructure configurations, and logical flows before actual vulnerability analysis. By pre-establishing these mappings during the runtime execution phase, the system prepares the necessary data structures and relationships in advance, enabling faster and more comprehensive vulnerability assessment without requiring time-consuming real-time analysis of all layers.
Solution Approach 2:
The system incorporates feedback mechanisms that allow it to learn from previous mapping results and adjust its analysis focus. By analyzing the mapped logical flows and identifying high-risk paths, the system can prioritize vulnerability detection efforts, reducing overall analysis time while maintaining comprehensive coverage of critical security aspects.
3Measurement precision
If runtime integration is implemented, then the accuracy of vulnerable flow identification improves, but the integration complexity with existing systems increases
Solution Approach 1:
The system implements universal mapping mechanisms that can integrate with various cloud-native components and infrastructure elements through standardized interfaces. The runtime function mapping, infrastructure mapping, and logical flow mapping can be applied across different service architectures, container platforms, and cloud providers, reducing integration complexity while maintaining high accuracy through adaptable mapping strategies.
Solution Approach 2:
The patent introduces intermediary mapping structures that act as mediators between different layers of the cloud-native application stack. These intermediaries translate and reconcile data from runtime functions, infrastructure configurations, and logical flows into a unified vulnerability representation, simplifying the integration process while enabling accurate multi-layer vulnerability detection.
Data Source
AI summary
A method for assessing vulnerable flows in a cloud-native application, the method including the steps of: mapping runtime functions in microservices in the cloud-native application; mapping the application cloud-native stack infrastructure configurations; mapping logical flows between microservices and third-party components in the cloud-native application; creating and executing security tests on the mapped logical flows, infrastructure configurations and runtime functions to return tested runtime behavior; and analyzing the tested runtime behavior of the cloud native application to validate the potential vulnerable logical flows so as to return validated vulnerable flows.